Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Doom (1993) in a PDF

doompdf.pages.dev

Post reply on HN
Print view View original

21–30 of 78 posts

Re: Show HN: Doom (1993) in a PDF

#21

Post by lolinder »

quotemstr wrote: post #20
p_ing wrote: post #18

Earlier quoted context omitted.

JS is what made these file types into the Pretty Dangerous Format. Numerous vulnerabilities in Adobe Acrobat surfaced thanks to the embedded JS engine. Updating the Acrobat client across an enterprise used to be quite burdensome.

The flip side is that because the industry has converged on just a few embedded scripting systems (JS, Lua, etc.) we can concentrate our security hardening efforts on these few engines and benefit everyone. If PDF, like PostScript, were its own custom thing, it couldn't have been able to benefit from this hardening. In the end, JS was a fine choice.

The concern isn't that it was JS, the concern is that there's a scripting system inside of PDF at all. Why? What? Form validation is a lousy excuse because forms themselves were a bridge too far for the format. Why do we need to be able to validate them?

I knew PDFs could be dangerous, but I didn't realize it was because they're intentionally designed to allow embedded scripts.

Re: Show HN: Doom (1993) in a PDF

#25

Post by llm_trw »

quotemstr wrote: post #17
pavo-etc wrote: post #3

> limited JS runtime of the PDF engine humanity has gone too far

:-) I'll never quite appreciate why people say things like this. Having some kind of embedded scripting is useful for all sorts of things, often form validation. A sufficiently complex validation system becomes Turing complete, so you might as well skip the hassle of a custom language and go right to JavaScript. Once you have JavaScript, input, and some way of updating a graphical pixel grid, you're at Doom-completen…

We had that language, it was postscript.

Then pdf came along and said: no this is too dangerous the only thing in a document should be layout information not arbitrary code.

And here we are two decades later.

My hatred of pdf has no end. It killed postscript for dynamic pages and djvu for static pages.

Re: Show HN: Doom (1993) in a PDF

#27

Post by DiggyJohnson »

llm_trw wrote: post #25
quotemstr wrote: post #17

Earlier quoted context omitted.

:-) I'll never quite appreciate why people say things like this. Having some kind of embedded scripting is useful for all sorts of things, often form validation. A sufficiently complex validation system becomes Turing complete, so you might as well skip the hassle of a custom language and go right to JavaScript. Once you have JavaScript, input, and some way of updating a graphical pixel grid, you're at Doom-completen…

We had that language, it was postscript. Then pdf came along and said: no this is too dangerous the only thing in a document should be layout information not arbitrary code. And here we are two decades later. My hatred of pdf has no end. It killed postscript for dynamic pages and djvu for static pages.

This is a very concise explanation, thanks for putting it so clearly. It’s not the features or requirements that are the focus of the scorn, per se, but how we got here. I still prefer and use PDF all the time, but between overly dynamic crap and the mainstream tooling, well… “hate” is a reasonable hyperbole.
Post reply on HN